fix: address PR #814 review + SonarCloud gate

SonarCloud:
- Resolve 6 S5332 hotspots (http→https in test fixture URLs).
- S6418: hoist the unauthenticated AsyncOpenAI placeholder to a named constant
  + NOSONAR (genuine non-secret; gateway ignores it when unauthenticated).
- Fix two reliability bugs: None-index guard in the gateway token-cache test
  (S2259) and float `> 0.0` instead of `!= 0.0` in the sentinel test (S1244).
- status.py idle path sleeps 0.1s instead of sleep(0) (S7491); NOSONAR on the
  protocol-required async no-await aclose() stubs (S7503).

Claude review:
- Remove three leftover debug print() calls in app.py (logger.info already
  covers them).
- payload_backfill: drop parsed_at from the backfilled-keys docstring (it is
  per-document state, not a deployment scalar); add a clean 404 precondition
  for BasicAuth deployments without an OAuth token verifier.
- status.py: task_status typed TaskStatus | None (drop type: ignore).
- nats.py: TODO to thread etags for file/deck/news; note etag default → None.
- factory: warn on unknown INGEST_BUS_URL scheme; raise ValueError instead of
  assert for the external-mode preconditions.
- docs/configuration.md: document the decomposition hook-point env vars + that
  nats-py ships core (lazy-imported) and external+bus uses two NATS connections.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/embedding/gateway_client.py

@@ -35,6 +35,11 @@ logger = logging.getLogger(__name__)
 # token never expires mid-flight (matches AstrolabeClient / CP CLI behavior).
 _EARLY_REFRESH_SECONDS = 60
 
+# Non-secret placeholder for AsyncOpenAI, which rejects an empty key. In
+# unauthenticated mode the gateway ignores the bearer; when a token provider is
+# configured, the real M2M token replaces this before each request.
+_UNAUTHENTICATED_PLACEHOLDER = "unauthenticated"
+
 
 class GatewayTokenProvider:
     """Caches a gateway M2M access token via the ``client_credentials`` grant.
@@ -106,7 +111,7 @@ class GatewayProvider(OpenAIProvider):
         # the gateway is unauthenticated. When a token provider is configured,
         # the real Bearer is set on the client before each request.
         super().__init__(
-            api_key="gateway-unauthenticated",
+            api_key=_UNAUTHENTICATED_PLACEHOLDER,  # NOSONAR: placeholder, not a secret
             base_url=base_url,
             embedding_model=embedding_model,
             generation_model=None,  # gateway never generates